Skip to Content

Researchers Find Security Cracks in Google Glass

Starting with Google Glass, wearable technology could usher in a new era of security weaknesses, researchers say.
July 17, 2013

Internet-connected devices are ripe for hacking—and it seems that wearable gadgets like Google’s forthcoming head-mounted computer, Glass, are no exception.

Marc Rogers, principal security researcher at mobile security startup Lookout, said this week that the company’s researchers examined Google Glass in May, looking for weaknesses that hackers could exploit. They soon focused on the fact that Google uses QR codes to let users configure Glass, and that whenever a Glass user takes a photo, the device searches for readable information (including QR codes).

The researchers learned that it was possible to use custom QR codes to get Glass to do things without the wearer’s knowledge, like quietly connect to a hacker-controlled wireless network. This could occur when the wearer takes a picture of a QR code on a poster or T-shirt, for example, believing the code to be benign.

Lookout detailed the weakness in a post on its blog on Wednesday, and released a short video explaining the problem.

The Lookout researchers found that by creating a QR code that caused Glass to connect to their own wireless access point, they could control traffic coming on and off the device, Rogers said. In theory, this would allow a hacker to spy on a user’s uploaded photos, or direct him to malware on the Web.

Similarly, the researchers found that a QR code could force Glass to connect via Bluetooth to a device of the researcher’s choosing, without the Glass wearer’s knowledge.

Though Lookout quickly reported the weakness to Google, and the search company fixed the problem within two weeks, it points to a larger problem: as everything from glasses to watches to thermostats become Internet-connected, those gadgets become vulnerable to malware and other security and privacy issues.

“I think bad guys will target wherever they feel the opportunity is,” said Rogers, noting that every popular computing platform has become a target for malware.

Rogers sees Google as a good test case for how such connected devices can be rolled out: before selling Glass next year to the general public, the company offered it to a limited group of testers, who are developing apps and finding bugs—a move the company says is intended to resolve problems in advance of general sales.

Because of this, Rogers expects that when Glass is released, Google will have not only fixed most of the “low-hanging” vulnerabilities, but will also be able to quickly fix any other issues that emerge.

Keep Reading

Most Popular

This nanoparticle could be the key to a universal covid vaccine

Ending the covid pandemic might well require a vaccine that protects against any new strains. Researchers may have found a strategy that will work.

How do strong muscles keep your brain healthy?

There’s a robust molecular language being spoken between your muscles and your brain.

The 1,000 Chinese SpaceX engineers who never existed

LinkedIn users are being scammed of millions of dollars by fake connections posing as graduates of prestigious universities and employees at top tech companies.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.